CVE-2026-12327: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Synopsis

Memory safety bugs affecting Mozilla Firefox and Thunderbird allow a remote, unauthenticated attacker to trigger memory corruption via the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the service is reachable over the network with no login or user action required, and successful exploitation enables limited data disclosure, content tampering, and potential arbitrary code execution. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Firefox or Thunderbird instance over the network; no physical or local access is needed (AV:N).

• AuthenticationNot required

  No login or account credentials are needed to trigger the vulnerability (PR:N).

• Victim interactionNot required

  The attacker does not need the user to click a link or take any action to initiate exploitation (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors need to be arranged (AC:L).

Blast Radius

• A successful attacker reads a limited subset of in-process data, which may include browsing session content or in-memory application data (C:L).
• The attacker modifies a limited subset of in-process data or rendered content, enabling partial content tampering (I:L).
• Memory corruption can destabilize the browser or mail client process, causing crashes and service interruption (A:L).
• Where memory corruption is leveraged to its fullest extent, the attacker runs arbitrary code within the browser or Thunderbird process context.